PT-2024-31614 · Twig+3 · Twig+3

Fabpot · Published 2024-09-09 · Updated 2026-05-22 · CVE-2024-45411

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 1.44.8 Twig versions prior to 2.16.1 Twig versions prior to 3.14.0

Description: Under some circumstances, the sandbox security checks are not run, which allows user-contributed templates to bypass the sandbox restrictions. This issue occurs when the sandbox is disabled globally, and a sandboxed include() function references a template name that has been loaded before in a non-sandbox context.

Recommendations: For versions prior to 1.44.8, update to version 1.44.8 or later. For versions prior to 2.16.1, update to version 2.16.1 or later. For versions prior to 3.14.0, update to version 3.14.0 or later. As a temporary workaround, consider enabling the sandbox security checks globally to prevent user-contributed templates from bypassing the sandbox restrictions.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2025-06075

CVE-2024-45411

DLA-3888-1

DSA-5771-1

GHSA-6J75-5WFJ-GH66

USN-7456-1

USN-7549-1

Affected Products

Linuxmint

Red Os

Twig

Ubuntu

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45411.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml · Exploit
• https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233 · Patch
• https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de · Patch
• https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6 · Patch
• https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45411 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7456-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45411 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45411 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45411 · Security Note
• https://osv.dev/vulnerability/DSA-5771-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45411 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45411 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3888-1 · Vendor Advisory